S&P Global agreed on Thursday to acquire OpenZeppelin, the smart-contract security firm whose open-source code library has underpinned more than $37 trillion in cumulative onchain transfers, according to the two companies. Terms of the deal were not disclosed, and it is subject to standard closing conditions.
OpenZeppelin’s libraries are embedded in much of the infrastructure behind stablecoins, tokenised funds and DeFi protocols, and its team has run more than 900 security engagements that surfaced over 10,000 vulnerabilities before code reached production. Founder and chief executive Demian Brener will keep running the business as its own unit inside S&P Global. The pitch is that a project can look sound on paper, with solid reserves and a clean credit profile, and still fail because of a flaw in the code that moves the money.
The acquisition extends a run of digital-asset moves S&P Global has made in recent weeks, including a strategic investment that helped extend crypto data firm Kaiko’s Series B to $110 million alongside BNP Paribas and Coinbase Ventures, and the launch of a co-branded digital asset index suite with Kaiko earlier in September. S&P has also already issued the first credit rating of a DeFi protocol, Sky. Buying OpenZeppelin lets it rate the code a project runs on, not just the entity that runs it.
S&P has not said whether it plans to fold OpenZeppelin’s audit findings into public ratings or benchmarks, or keep them as a separate commercial service sold back to the institutions S&P also rates. A $120 billion ratings company grading the smart contracts underneath the assets it also assesses is a new kind of conflict for compliance departments to work out, and nobody involved has addressed it yet.
